> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workato

## After this article

You'll be able to connect Workato to Lumos and sync users, roles (custom and system), and workspaces for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User account records |
| Custom Roles | Permission | Yes | No | Custom roles |
| System Roles | Permission | Yes | No | System roles |
| Workspace | Permission | Yes | No | Workspaces in Workato |

This is a sync-only integration. Lumos reads users, roles, and workspaces from Workato and doesn't provision or change anything in Workato.

## Required plan and roles

* **Workato role:** you must be a **Workspace Owner** or **Admin** to generate the API token.
* **API client access:** when you create the API client for the token, grant these: **Get Collaborators**, **Get Workspace Details**, **Get /api/roles**, **Get /api/environment\_roles**, **Get On-Prem (groups)**, and access to all projects.
* **Environments:** if your workspace uses environments, this connector works only for API clients with **DEV** access.

## Read-only access vs provisioning

**Is read-only possible?** Yes. This is a sync-only integration. Lumos reads users, roles, and workspaces from Workato and doesn't provision or change anything there.

**What read-only requires.** An API client created by a Workspace Owner or Admin, granted the Get Collaborators, Get Workspace Details, Get /api/roles, Get /api/environment\_roles, and Get On-Prem (groups) permissions, with access to all projects. If your workspace uses environments, the client also needs DEV access. Follow the steps below.

**Watch out for.** The permissions this connector needs are all read-only ("Get") calls already, so there isn't a broader scope to accidentally grant. If your workspace uses environments, a token from a non-DEV client will break the connection. Regenerate it with a DEV-access client.

## Instructions

**Phase 1: Gather an API token in Workato**

1. Log in to your Workato workspace at `https://app.workato.com/users/sign_in` as a Workspace Owner or Admin.
2. Go to **Workspace Admin**.
3. Open the **API Clients** tab.
4. Create a new API client and assign the appropriate client role and project scopes.
5. Copy the generated API token.

**Phase 2: Gather your region**

Note the region of your Workato workspace. It defaults to **US**.

**Phase 3: Connect in Lumos**

Enter the API token and region in Lumos, then click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**List accounts fails with a 404 on `/api/members`.** The `/members` endpoint can return a 404 (API not found), which may depend on your account plan. The connector was corrected to handle this so account listing still works. If you keep seeing errors, contact Lumos support.

**Connection or sync fails in a workspace with environments.** If your workspace uses environments, the API client must have **DEV** access. Regenerate the token with a DEV-access client.